Coinbase says thieves stole user data and tried to extort $20M

Thieves recently stole Coinbase customers’ personal information and tried to extort it for $20 million, the company announced Thursday.

Coinbase, the United States’ largest cryptocurrency exchange, said that instead of paying, it is offering a $20 million bounty for information leading to the arrest of those responsible.

In a Wednesday evening filing with the Securities and Exchange Commission, Coinbase said that it received an extortion email on Sunday from criminals who had obtained some users’ names, addresses, contact information, government identification, transaction history and the last four digits of their Social Security numbers.

The criminals gained the information by paying overseas contractors and support workers to hand it over, Coinbase said.

Cryptocurrency exchanges are top targets for hackers and other cybercriminals, as bitcoin and other cryptocurrencies work outside of traditional banking systems and are often difficult to retrieve if stolen. Coinbase had largely avoided major cyber incidents until now.

The company declined to say how much customer information was accessed, though in a video addressing the scam posted to X, Coinbase CEO Brian Armstrong said it was fewer than 1% of the company’s monthly active users.